Changelog

   1 - Add agent support to zabbix from Sven Vermeulen.
   2 - Cyrus file context update for Gentoo from Corentin Labbe.
   3 - Portage updates from Sven Vermeulen.
   4 - Fix init_system_domain() description, pointed out by Elia Pinto.
   5 - Postgresql selabel_lookup update from KaiGai Kohei.
   6 - Dovecot managesieve support from Mika Pfluger.
   7 - Semicolon after interface/template calls cleanup from Elia Pinto.
   8 - Gentoo courier updates from Sven Vermeulen.
   9 - Amavis patch for connecting to nslcd from Miroslav Grepl.
  10 - Shorewall patch from Miroslav Grepl.
  11 - Cpufreqselector dbus patch from Guido Trentalancia.
  12 - Cron pam_namespace and pam_loginuid support from Harry Ciao.
  13 - Xserver update for startx from Sven Vermeulen.
  14 - Fix MLS constraint for contains permission from Harry Ciao.
  15 - Apache user webpages fix from Dominick Grift.
  16 - Change default build.conf to modular policy from Stephen Smalley.
  17 - Xen refinement patch from Stephen Smalley.
  18 - Sudo timestamp file location update from Sven Vermeulen.
  19 - XServer keyboard event patch from Sven Vermeulen.
  20 - RAID uevent patch from Sven Vermeulen.
  21 - Gentoo ALSA init script usage patch from Sven Vermeulen.
  22 - LVM semaphore usage patch from Sven Vermeulen.
  23 - Module load request patch for insmod from Sven Vermeulen.
  24 - Cron default contexts fix from Harry Ciao.
  25 - Man page fixes from Justin Mattock.
  26 - Add syslog capability.
  27 - Support for logging in to /dev/console, from Harry Ciao.
  28 - Database object class updates and associated SEPostgreSQL changes from
  29   KaiGai Kohei.
  30 - IPSEC SPD and Hadoop IPSEC updates from Paul Nuzzi.
  31 - Mount updates from Harry Ciao.
  32 - Semanage update for MLS systems from Harry Ciao.
  33 - Vlock terminal use update from Harry Ciao.
  34 - Hadoop CDH3 updates from Paul Nuzzi.
  35 - Add sepgsql_contexts appconfig files from KaiGai Kohei.
  36 - Added modules:
  37         aiccu
  38         bugzilla (Dan Walsh)
  39         colord (Dan Walsh)
  40         cmirrord (Miroslav Grepl)
  41         mediawiki (Miroslav Grepl)
  42         mpd (Miroslav Grepl)
  43         ncftool
  44         passenger (Miroslav Grepl)
  45         qpid (Dan Walsh)
  46         samhain (Harry Ciao)
  47         telepathy (Dominick Grift)
  48         tcsd (Stephen Smalley)
  49         vnstatd (Dan Walsh)
  50         zarafa (Miroslav Grepl)
  51
  52 * Mon Dec 13 2010 Chris PeBenito <selinux@tresys.com> - 2.20101213
  53 - Git man page from Dominick Grift.
  54 - Alsa and oident home content cleanup from Dominick Grift.
  55 - Add support for custom build options.
  56 - Unconditional staff and user oidentd home config access from Dominick Grift.
  57 - Conditional mmap_zero support from Dominick Grift.
  58 - Added devtmpfs support.
  59 - Dbadm updates from KaiGai Kohei.
  60 - Virtio disk file context update from Mika Pfluger.
  61 - Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.
  62 - Add JIT usage for freshclam.
  63 - Remove ethereal module since the application was renamed to wireshark.
  64 - Remove duplicate/redundant rules, from Russell Coker.
  65 - Increased default number of categories to 1024, from Russell Coker.
  66 - Added modules:
  67         accountsd (Dan Walsh)
  68         cgroup (Dominick Grift)
  69         hadoop (Paul Nuzzi)
  70         kdumpgui (Dan Walsh)
  71         livecd (Dan Walsh)
  72         mojomojo (Iain Arnell)
  73         sambagui (Dan Walsh)
  74         shutdown (Dan Walsh)
  75         sosreport (Dan Walsh)
  76         vlock (Harry Ciao)
  77
  78 * Mon May 24 2010 Chris PeBenito <selinux@tresys.com> - 2.20100524
  79 - Merged a significant portion of Fedora policy.
  80 - Move rules from mta mailserver delivery from interface to .te to use
  81   attributes.
  82 - Remove concept of users from terminal module interfaces since the
  83   attributes are not specific to users.
  84 - Add non-drawing X client support, for consolekit usage.
  85 - Misc Gentoo fixes from Chris Richards.
  86 - AFS and abrt fixes from Dominick Grift.
  87 - Improved the XML docs of 55 most-used interfaces.
  88 - Apcupsd and amavis fixes from Dominick Grift.
  89 - Fix network_port() in corenetwork to correctly handle port ranges.
  90 - SE-Postgresql updates from KaiGai Kohei.
  91 - X object manager revisions from Eamon Walsh.
  92 - Added modules:
  93         aisexec (Dan Walsh)
  94         chronyd (Miroslav Grepl)
  95         cobbler (Dominick Grift)
  96         corosync (Dan Walsh)
  97         dbadm (KaiGai Kohei)
  98         denyhosts (Dan Walsh)
  99         nut (Stefan Schulze Frielinghaus, Miroslav Grepl)
 100         likewise (Scott Salley)
 101         plymouthd (Dan Walsh)
 102         pyicqt (Stefan Schulze Frielinghaus)
 103         rhcs (Dan Walsh)
 104         rgmanager (Dan Walsh)
 105         sectoolm (Miroslav Grepl)
 106         usbmuxd (Dan Walsh)
 107         vhostmd (Dan Walsh)
 108
 109 * Tue Nov 17 2009 Chris PeBenito <selinux@tresys.com> - 2.20091117
 110 - Add separate x_pointer and x_keyboard classes inheriting from x_device.
 111   From Eamon Walsh.
 112 - Deprecated the userdom_xwindows_client_template().
 113 - Misc Gentoo fixes from Corentin Labbe.
 114 - Debian policykit fixes from Martin Orr.
 115 - Fix unconfined_r use of unconfined_java_t.
 116 - Add missing x_device rules for XI2 functions, from Eamon Walsh.
 117 - Add missing rules to make unconfined_cronjob_t a valid cron job domain.
 118 - Add btrfs and ext4 to labeling targets.
 119 - Fix infrastructure to expand macros in initrc_context when installing.
 120 - Handle unix_chkpwd usage by useradd and groupadd.
 121 - Add missing compatibility aliases for xdm_xserver*_t types.
 122 - Added modules:
 123         abrt (Dan Walsh)
 124         dkim (Stefan Schulze Frielinghaus)
 125         gitosis (Miroslav Grepl)
 126         gnomeclock (Dan Walsh)
 127         hddtemp (Dan Walsh)
 128         kdump (Dan Walsh)
 129         modemmanager(Dan Walsh)
 130         nslcd (Dan Walsh)
 131         puppet (Craig Grube)
 132         rtkit (Dan Walsh)
 133         seunshare (Dan Walsh)
 134         shorewall (Dan Walsh)
 135         tgtd (Matthew Ife)
 136         tuned (Miroslav Grepl)
 137         xscreensaver (Corentin Labbe)
 138
 139 * Thu Jul 30 2009 Chris PeBenito <selinux@tresys.com> - 2.20090730
 140 - Gentoo fixes for init scripts and system startup.
 141 - Remove read_default_t tunable.
 142 - Greylist milter from Paul Howarth.
 143 - Crack db access for su to handle password expiration, from Brandon Whalen.
 144 - Misc fixes for unix_update from Brandon Whalen.
 145 - Add x_device permissions for XI2 functions, from Eamon Walsh.
 146 - MLS constraints for the x_selection class, from Eamon Walsh.
 147 - Postgresql updates from KaiGai Kohei.
 148 - Milter state directory patch from Paul Howarth.
 149 - Add MLS constrains for ingress/egress and secmark from Paul Moore.
 150 - Drop write permission from fs_read_rpc_sockets().
 151 - Remove unused udev_runtime_t type.
 152 - Patch for RadSec port from Glen Turner.
 153 - Enable network_peer_controls policy capability from Paul Moore.
 154 - Btrfs xattr support from Paul Moore.
 155 - Add db_procedure install permission from KaiGai Kohei.
 156 - Add support for network interfaces with access controlled by a Boolean
 157   from the CLIP project.
 158 - Several fixes from the CLIP project.
 159 - Add support for labeled Booleans.
 160 - Remove node definitions and change node usage to generic nodes.
 161 - Add kernel_service access vectors, from Stephen Smalley.
 162 - Added modules:
 163         certmaster (Dan Walsh)
 164         cpufreqselector (Dan Walsh)
 165         devicekit (Dan Walsh)
 166         fprintd (Dan Walsh)
 167         git (Dan Walsh)
 168         gpsd (Miroslav Grepl)
 169         guest (Dan Walsh)
 170         ifplugd (Dan Walsh)
 171         lircd (Miroslav Grepl)
 172         logadm (Dan Walsh)
 173         pads (Dan Walsh)
 174         pingd (Dan Walsh)
 175         policykit (Dan Walsh)
 176         pulseaudio (Dan Walsh)
 177         psad (Dan Walsh)
 178         portreserve (Dan Walsh)
 179         sssd (Dan Walsh)
 180         ulogd (Dan Walsh)
 181         varnishd (Dan Walsh)
 182         webadm (Dan Walsh)
 183         wm (Dan Walsh)
 184         xguest (Dan Walsh)
 185         zosremote (Dan Walsh)
 186
 187 * Wed Dec 10 2008 Chris PeBenito <selinux@tresys.com> - 2.20081210
 188 - Fix consistency of audioentropy and iscsi module naming.
 189 - Debian file context fix for xen from Russell Coker.
 190 - Xserver MLS fix from Eamon Walsh.
 191 - Add omapi port for dhcpcd.
 192 - Deprecate per-role templates and rolemap support.
 193 - Implement user-based access control for use as role separations.
 194 - Move shared library calls from individual modules to the domain module.
 195 - Enable open permission checks policy capability.
 196 - Remove hierarchy from portage module as it is not a good example of
 197   hieararchy.
 198 - Remove enableaudit target from modular build as semodule -DB supplants it.
 199 - Added modules:
 200         milter (Paul Howarth)
 201
 202 * Tue Oct 14 2008 Chris PeBenito <selinux@tresys.com> - 20081014
 203 - Debian update for NetworkManager/wpa_supplicant from Martin Orr.
 204 - Logrotate and Bind updates from Vaclav Ovsik.
 205 - Init script file and domain support.
 206 - Glibc 2.7 fix from Vaclav Ovsik.
 207 - Samba/winbind update from Mike Edenfield.
 208 - Policy size optimization with a non-security file attribute from James
 209   Carter.
 210 - Database labeled networking update from KaiGai Kohei.
 211 - Several misc changes from the Fedora policy, cherry picked by David
 212   Hardeman.
 213 - Large whitespace fix from Dominick Grift.
 214 - Pam_mount fix for local login from Stefan Schulze Frielinghaus.
 215 - Issuing commands to upstart is over a datagram socket, not the initctl
 216   named pipe.  Updated init_telinit() to match.
 217 - Added modules:
 218         cyphesis (Dan Walsh)
 219         memcached (Dan Walsh)
 220         oident (Dominick Grift)
 221         w3c (Dan Walsh)
 222
 223 * Wed Jul 02 2008 Chris PeBenito <selinux@tresys.com> - 20080702
 224 - Fix httpd_enable_homedirs to actually provide the access it is supposed to
 225   provide.
 226 - Add unused interface/template parameter metadata in XML.
 227 - Patch to handle postfix data_directory from Vaclav Ovsik.
 228 - SE-Postgresql policy from KaiGai Kohei.
 229 - Patch for X.org dbus support from Martin Orr.
 230 - Patch for labeled networking controls in 2.6.25 from Paul Moore.
 231 - Module loading now requires setsched on kernel threads.
 232 - Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.
 233 - X application data class from Eamon Walsh and Ted Toth.
 234 - Move user roles into individual modules.
 235 - Make hald_log_t a log file.
 236 - Cryptsetup runs shell scripts.  Patch from Martin Orr.
 237 - Add file for enabling policy capabilities.
 238 - Patch to fix leaky interface/template call depth calculator from Vaclav
 239   Ovsik.
 240 - Added modules:
 241         kerneloops (Dan Walsh)
 242         kismet (Dan Walsh)
 243         podsleuth (Dan Walsh)
 244         prelude (Dan Walsh)
 245         qemu (Dan Walsh)
 246         virt (Dan Walsh)
 247
 248 * Wed Apr 02 2008 Chris PeBenito <selinux@tresys.com> - 20080402
 249 - Add core Security Enhanced X Windows support.
 250 - Fix winbind socket connection interface for default location of the
 251   sock_file.
 252 - Add wireshark module based on ethereal module.
 253 - Revise upstart support in init module to use a tunable, as upstart is now
 254   used in Fedora too.
 255 - Add iferror.m4 rather generate it out of the Makefiles.
 256 - Definitions for open permisson on file and similar objects from Eric
 257   Paris.
 258 - Apt updates for ptys and logs, from Martin Orr.
 259 - RPC update from Vaclav Ovsik.
 260 - Exim updates on Debian from Devin Carrawy.
 261 - Pam and samba updates from Stefan Schulze Frielinghaus.
 262 - Backup update on Debian from Vaclav Ovsik.
 263 - Cracklib update on Debian from Vaclav Ovsik.
 264 - Label /proc/kallsyms with system_map_t.
 265 - 64-bit capabilities from Stephen Smalley.
 266 - Labeled networking peer object class updates.
 267
 268 * Fri Dec 14 2007 Chris PeBenito <selinux@tresys.com> - 20071214
 269 - Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.
 270 - Improve several tunables descriptions from Dan Walsh.
 271 - Patch to clean up ns switch usage in the policy from Dan Walsh.
 272 - More complete labeled networking infrastructure from KaiGai Kohei.
 273 - Add interface for libselinux constructor, for libselinux-linked
 274   SELinux-enabled programs.
 275 - Patch to restructure user role templates to create restricted user roles
 276   from Dan Walsh.
 277 - Russian man page translations from Andrey Markelov.
 278 - Remove unused types from dbus.
 279 - Add infrastructure for managing all user web content.
 280 - Deprecate some old file and dir permission set macros in favor of the
 281   newer, more consistently-named macros.
 282 - Patch to clean up unescaped periods in several file context entries from
 283   Jan-Frode Myklebust.
 284 - Merge shlib_t into lib_t.
 285 - Merge strict and targeted policies.  The policy will now behave like the
 286   strict policy if the unconfined module is not present.  If it is, it will
 287   behave like the targeted policy.  Added an unconfined role to have a mix
 288   of confined and unconfined users.
 289 - Added modules:
 290         exim (Dan Walsh)
 291         postfixpolicyd (Jan-Frode Myklebust)
 292
 293 * Fri Sep 28 2007 Chris PeBenito <selinux@tresys.com> - 20070928
 294 - Add support for setting the unknown permissions handling.
 295 - Fix XML building for external reference builds and headers builds.
 296 - Patch to add missing requirements in userdomain interfaces from Shintaro
 297   Fujiwara.
 298 - Add tcpd_wrapped_domain() for services that use tcp wrappers.
 299 - Update MLS constraints from LSPP evaluated policy.
 300 - Allow initrc_t file descriptors to be inherited regardless of MLS level.
 301   Accordingly drop MLS permissions from daemons that inherit from any level.
 302 - Files and radvd updates from Stefan Schulze Frielinghaus.
 303 - Deprecate mls_file_write_down() and mls_file_read_up(), replaced with
 304   mls_write_all_levels() and mls_read_all_levels(), for consistency.
 305 - Add make kernel and init ranged interfaces pass the range transition MLS
 306   constraints.  Also remove calls to mls_rangetrans_target() in modules that use
 307   the kernel and init interfaces, since its redundant.
 308 - Add interfaces for all MLS attributes except X object classes.
 309 - Require all sensitivities and categories for MLS and MCS policies, not just
 310   the low and high sensitivity and category.
 311 - Database userspace object manager classes from KaiGai Kohei.
 312 - Add third-party interface for Apache CGI.
 313 - Add getserv and shmemserv nscd permissions.
 314 - Add debian apcupsd binary location, from Stefan Schulze Frielinghaus.
 315 - Added modules:
 316         application
 317         awstats (Stefan Schulze Frielinghaus)
 318         bitlbee (Devin Carraway)
 319         brctl (Dan Walsh)
 320
 321 * Fri Jun 29 2007 Chris PeBenito <selinux@tresys.com> - 20070629
 322 - Fix incorrectly named files_lib_filetrans_shared_lib() interface in the
 323   libraries module.
 324 - Unified labeled networking policy from Paul Moore.
 325 - Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore.
 326 - Xen updates from Dan Walsh.
 327 - Filesystem updates from Dan Walsh.
 328 - Large samba update from Dan Walsh.
 329 - Drop snmpd_etc_t.
 330 - Confine sendmail and logrotate on targeted.
 331 - Tunable connection to postgresql for users from KaiGai Kohei.
 332 - Memprotect support patch from Stephen Smalley.
 333 - Add logging_send_audit_msgs() interface and deprecate
 334   send_audit_msgs_pattern().
 335 - Openct updates patch from Dan Walsh.
 336 - Merge restorecon into setfiles.
 337 - Patch to begin separating out hald helper programs from Dan Walsh.
 338 - Fixes for squid, dovecot, and snmp from Dan Walsh.
 339 - Miscellaneous consolekit fixes from Dan Walsh.
 340 - Patch to have avahi use the nsswitch interface rather than individual
 341   permissions from Dan Walsh.
 342 - Patch to dontaudit logrotate searching avahi pid directory from Dan Walsh.
 343 - Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
 344   to handle usage from userhelper from Dan Walsh.
 345 - Patch to allow amavis to read spamassassin libraries from Dan Walsh.
 346 - Patch to allow slocate to getattr other filesystems and directories on those
 347   filesystems from Dan Walsh.
 348 - Fixes for RHEL4 from the CLIP project.
 349 - Replace the old lrrd fc entries with munin ones.
 350 - Move program admin template usage out of userdom_admin_user_template() to
 351   sysadm policy in userdomain.te to fix usage of the template for third
 352   parties.
 353 - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a
 354   template instead of an interface.
 355 - Added modules:
 356         amtu (Dan Walsh)
 357         apcupsd (Dan Walsh)
 358         rpcbind (Dan Walsh)
 359         rwho (Nalin Dahyabhai)
 360
 361 * Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
 362 - Patch for sasl's use of kerberos from Dan Walsh.
 363 - Patches to confine ldconfig, udev, and insmod in the targeted policy from Dan Walsh.
 364 - Man page updates from Dan Walsh.
 365 - Two patches from Paul Moore to for ipsec to remove redundant rules and
 366   have setkey read the config file.
 367 - Move booleans and tunables to modules when it is only used in a single
 368   module.
 369 - Add support for tunables and booleans local to a module.
 370 - Merge sbin_t and ls_exec_t into bin_t.
 371 - Remove disable_trans booleans.
 372 - Output different header sets for kernel and userland from flask headers.
 373 - Marked the pax class as deprecated, changed it to userland so
 374   it will be removed from the kernel.
 375 - Stop including netfilter contexts by default.
 376 - Add dontaudits for init fds and console to init_daemon_domain().
 377 - Patch to allow gpg to create user keys dir.
 378 - Patch to support kvmfs from Dan Walsh.
 379 - Patch for misc fixes in sudo from Dan Walsh.
 380 - Patch to fix netlabel recvfrom MLS constraint from Paul Moore.
 381 - Patch for handling restart of nscd when ran from useradd, groupadd, and
 382   admin passwd, from Dan Walsh.
 383 - Patch for procmail, spamassassin, and pyzor updates from Dan Walsh.
 384 - Patch for setroubleshoot for validating file contexts from Dan Walsh.
 385 - Patch for gssd fixes from Dan Walsh.
 386 - Patch for lvm fixes from Dan Walsh.
 387 - Patch for ricci fixes from Dan Walsh.
 388 - Patch for postfix lmtp labeling and pickup rule fix from Dan Walsh.
 389 - Patch for kerberized telnet fixes from Dan Walsh.
 390 - Patch for kerberized ftp and other ftp fixes from Dan Walsh.
 391 - Patch for an additional wine executable from Dan Walsh.
 392 - Eight patches for file contexts in games, wine, networkmanager, miscfiles,
 393   corecommands, devices, and java from Dan Walsh.
 394 - Add support for libselinux 2.0.5 init_selinuxmnt() changes.
 395 - Patch for misc fixes to bluetooth from Dan Walsh.
 396 - Patch for misc fixes to kerberos from Dan Walsh.
 397 - Patch to start deprecating usercanread attribute from Ryan Bradetich.
 398 - Add dccp_socket object class which was added in kernel 2.6.20.
 399 - Patch for prelink relabefrom it's temp files from Dan Walsh.
 400 - Patch for capability fix for auditd and networking fix for syslogd from
 401   Dan Walsh.
 402 - Patch to remove redundant mls_trusted_object() call from Dan Walsh.
 403 - Patch for misc fixes to nis ypxfr policy from Dan Walsh.
 404 - Patch to allow apmd to telinit from Dan Walsh.
 405 - Patch for additional labeling of samba files from Stefan Schulze
 406   Frielinghaus.
 407 - Patch to remove incorrect cron labeling in apache.fc from Ryan Bradetich.
 408 - Fix ptys and ttys to be device nodes.
 409 - Fix explicit use of httpd_t in openca_domtrans().
 410 - Clean up file context regexes in apache and java, from Eamon Walsh.
 411 - Patches from Dan Walsh:
 412         Thu, 25 Jan 2007
 413 - Added modules:
 414         consolekit (Dan Walsh)
 415         fail2ban (Dan Walsh)
 416         zabbix (Dan Walsh)
 417
 418 * Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212
 419 - Add policy patterns support macros.  This changes the behavior of
 420   the create_dir_perms and create_file_perms permission sets.
 421 - Association polmatch MLS constraint making unlabeled_t an exception
 422   is no longer needed, patch from Venkat Yekkirala.
 423 - Context contains checking for PAM and cron from James Antill.
 424 - Add a reload target to Modules.devel and change the load
 425   target to only insert modules that were changed.
 426 - Allow semanage to read from /root on strict non-MLS for
 427   local policy modules.
 428 - Gentoo init script fixes for udev.
 429 - Allow udev to read kernel modules.inputmap.
 430 - Dnsmasq fixes from testing.
 431 - Allow kernel NFS server to getattr filesystems so df can work
 432   on clients.
 433 - Patch from Matt Anderson for a MLS constraint exemption on a
 434   file that can be written to from a subject whose range is
 435   within the object's range.
 436 - Enhanced setransd support from Darrel Goeddel.
 437 - Patches from Dan Walsh:
 438         Tue, 24 Oct 2006
 439         Wed, 29 Nov 2006
 440 - Added modules:
 441         aide (Matt Anderson)
 442         ccs (Dan Walsh)
 443         iscsi (Dan Walsh)
 444         ricci (Dan Walsh)
 445
 446 * Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
 447 - Patch from Russell Coker Thu, 5 Oct 2006
 448 - Move range transitions to modules.
 449 - Make number of MLS sensitivities, and number of MLS and MCS
 450   categories configurable as build options.
 451 - Add role infrastructure.
 452 - Debian updates from Erich Schubert.
 453 - Add nscd_socket_use() to auth_use_nsswitch().
 454 - Remove old selopt rules.
 455 - Full support for netfilter_contexts.
 456 - MRTG patch for daemon operation from Stefan.
 457 - Add authlogin interface to abstract common access for login programs.
 458 - Remove setbool auditallow, except for RHEL4.
 459 - Change eventpollfs to task SID labeling.
 460 - Add key support from Michael LeMay.
 461 - Add ftpdctl domain to ftp, from Paul Howarth.
 462 - Fix build system to not move type declarations out of optionals.
 463 - Add gcc-config domain to portage.
 464 - Add packet object class and support in corenetwork.
 465 - Add a copy of genhomedircon for monolithic policy building, so that a
 466   policycoreutils package update is not required for RHEL4 systems.
 467 - Add appletalk sockets for use in cups.
 468 - Add Make target to validate module linking.
 469 - Make duplicate template and interface declarations a fatal error.
 470 - Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
 471 - Move xconsole_device_t from devices to xserver since it is
 472   not actually a device, it is a named pipe.
 473 - Handle nonexistant .fc and .if files in devel Makefile by
 474   automatically creating empty files.
 475 - Remove unused devfs_control_t.
 476 - Add rhel4 distro, which also implies redhat distro.
 477 - Remove unneeded range_transition for su_exec_t and move the
 478   type declaration back to the su module.
 479 - Constrain transitions in MCS so unconfined_t cannot have
 480   arbitrary category sets.
 481 - Change reiserfs from xattr filesystem to genfscon as it's xattrs
 482   are currently nonfunctional.
 483 - Change files and filesystem modules to use their own interfaces.
 484 - Add user fonts to xserver.
 485 - Additional interfaces in corecommands, miscfiles, and userdomain
 486   from Joy Latten.
 487 - Miscellaneous fixes from Thomas Bleher.
 488 - Deprecate module name as first parameter of optional_policy()
 489   now that optionals are allowed everywhere.
 490 - Enable optional blocks in base module and monolithic policy.
 491   This requires checkpolicy 1.30.1.
 492 - Fix vpn module declaration.
 493 - Numerous fixes from Dan Walsh.
 494 - Change build order to preserve m4 line number information so policy
 495   compile errors are useful again.
 496 - Additional MLS interfaces from Chad Hanson.
 497 - Move some rules out of domain_type() and domain_base_type()
 498   to the TE file, to use the domain attribute to take advantage
 499   of space savings from attribute use.
 500 - Add global stack smashing protector rule for urandom access from
 501   Petre Rodan.
 502 - Fix temporary rules at the bottom of portmap.
 503 - Updated comments in mls file from Chad Hanson.
 504 - Patches from Dan Walsh:
 505         Fri, 17 Mar 2006
 506         Wed, 29 Mar 2006
 507         Tue, 11 Apr 2006
 508         Fri, 14 Apr 2006
 509         Tue, 18 Apr 2006
 510         Thu, 20 Apr 2006
 511         Tue, 02 May 2006
 512         Mon, 15 May 2006
 513         Thu, 18 May 2006
 514         Tue, 06 Jun 2006
 515         Mon, 12 Jun 2006
 516         Tue, 20 Jun 2006
 517         Wed, 26 Jul 2006
 518         Wed, 23 Aug 2006
 519         Thu, 31 Aug 2006
 520         Fri, 01 Sep 2006
 521         Tue, 05 Sep 2006
 522         Wed, 20 Sep 2006
 523         Fri, 22 Sep 2006
 524         Mon, 25 Sep 2006
 525 - Added modules:
 526         afs
 527         amavis (Erich Schubert)
 528         apt (Erich Schubert)
 529         asterisk
 530         audioentropy
 531         authbind
 532         backup
 533         calamaris
 534         cipe
 535         clamav (Erich Schubert)
 536         clockspeed (Petre Rodan)
 537         courier
 538         dante
 539         dcc
 540         ddclient
 541         dpkg (Erich Schubert)
 542         dnsmasq
 543         ethereal
 544         evolution
 545         games
 546         gatekeeper
 547         gift
 548         gnome (James Carter)
 549         imaze
 550         ircd
 551         jabber
 552         monop
 553         mozilla
 554         mplayer
 555         munin
 556         nagios
 557         nessus
 558         netlabel (Paul Moore)
 559         nsd
 560         ntop
 561         nx
 562         oav
 563         oddjob (Dan Walsh)
 564         openca
 565         openvpn (Petre Rodan)
 566         perdition
 567         portslave
 568         postgrey
 569         pxe
 570         pyzor (Dan Walsh)
 571         qmail (Petre Rodan)
 572         razor
 573         resmgr
 574         rhgb
 575         rssh
 576         snort
 577         soundserver
 578         speedtouch
 579         sxid
 580         thunderbird
 581         tor (Erich Schubert)
 582         transproxy
 583         tripwire
 584         uptime
 585         uwimap
 586         vmware
 587         watchdog
 588         xen (Dan Walsh)
 589         xprint
 590         yam
 591
 592 * Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
 593 - Make all interface parameters required.
 594 - Move boot_t, system_map_t, and modules_object_t to files module,
 595   and move bootloader to admin layer.
 596 - Add semanage policy for semodule from Dan Walsh.
 597 - Remove allow_execmem from targeted policy domain_base_type().
 598 - Add users_extra and seusers support.
 599 - Postfix fixes from Serge Hallyn.
 600 - Run python and shell directly to interpret scripts so policy
 601   sources need not be executable.
 602 - Add desc tag XML to booleans and tunables, and add summary
 603   to param XML tag, to make future translations possible.
 604 - Remove unused lvm_vg_t.
 605 - Many interface renames to improve naming consistency.
 606 - Merge xdm into xserver.
 607 - Remove kernel module reversed interfaces.
 608 - Add filename attribute to module XML tag and lineno attribute to
 609   interface XML tag.
 610 - Changed QUIET build option to a yes or no option.
 611 - Add a Makefile used for compiling loadable modules in a
 612   user's development environment, building against policy headers.
 613 - Add Make target for installing policy headers.
 614 - Separate per-userdomain template expansion from the userdomain
 615   module and add infrastructure to expand templates in the modules
 616   that own the template.
 617 - Enable secadm only for MLS policies.
 618 - Remove role change rules in su and sudo since this functionality has been
 619   removed from these programs.
 620 - Add ctags Make target from Thomas Bleher.
 621 - Collapse commands with grep piped to sed into one sed command.
 622 - Fix type_change bug in term_user_pty().
 623 - Move ice_tmp_t from miscfiles to xserver.
 624 - Login fixes from Serge Hallyn.
 625 - Move xserver_log_t from xdm to xserver.
 626 - Add lpr per-userdomain policy to lpd.
 627 - Miscellaneous fixes from Dan Walsh.
 628 - Change initrc_var_run_t interface noun from script_pid to utmp,
 629   for greater clarity.
 630 - Added modules:
 631         certwatch
 632         mono (Dan Walsh)
 633         mrtg
 634         portage
 635         tvtime
 636         userhelper
 637         usernetctl
 638         wine (Dan Walsh)
 639         xserver
 640
 641 * Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
 642 - Adds support for generating corenetwork interfaces based on attributes
 643   in addition to types.
 644 - Permits the listing of multiple nodes in a network_node() that will be
 645   given the same type.
 646 - Add two new permission sets for stream sockets.
 647 - Rename file type transition interfaces verb from create to
 648   filetrans to differentiate it from create interfaces without
 649   type transitions.
 650 - Fix expansion of interfaces from disabled modules.
 651 - Rsync can be long running from init,
 652   added rules to allow this.
 653 - Add polyinstantiation build option.
 654 - Add setcontext to the association object class.
 655 - Add apache relay and db connect tunables.
 656 - Rename texrel_shlib_t to textrel_shlib_t.
 657 - Add swat to samba module.
 658 - Numerous miscellaneous fixes from Dan Walsh.
 659 - Added modules:
 660         alsa
 661         automount
 662         cdrecord
 663         daemontools (Petre Rodan)
 664         ddcprobe
 665         djbdns (Petre Rodan)
 666         fetchmail
 667         irc
 668         java
 669         lockdev
 670         logwatch (Dan Walsh)
 671         openct
 672         prelink (Dan Walsh)
 673         publicfile (Petre Rodan)
 674         readahead
 675         roundup
 676         screen
 677         slocate (Dan Walsh)
 678         slrnpull
 679         smartmon
 680         sysstat
 681         ucspitcp (Petre Rodan)
 682         usbmodules
 683         vbetool (Dan Walsh)
 684
 685 * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
 686 - Add unlabeled IPSEC association rule to domains with
 687   networking permissions.
 688 - Merge systemuser back in to users, as these files
 689   do not need to be split.
 690 - Add check for duplicate interface/template definitions.
 691 - Move domain, files, and corecommands modules to kernel
 692   layer to resolve some layering inconsistencies.
 693 - Move policy build options out of Makefile into build.conf.
 694 - Add yppasswd to nis module.
 695 - Change optional_policy() to refer to the module name
 696   rather than modulename.te.
 697 - Fix labeling targets to use installed file_contexts rather
 698   than partial file_contexts in the policy source directory.
 699 - Fix build process to use make's internal vpath functions
 700   to detect modules rather than using subshells and find.
 701 - Add install target for modular policy.
 702 - Add load target for modular policy.
 703 - Add appconfig dependency to the load target.
 704 - Miscellaneous fixes from Dan Walsh.
 705 - Fix corenetwork gen_context()'s to expand during the policy
 706   build phase instead of during the generation phase.
 707 - Added policies:
 708         amanda
 709         avahi
 710         canna
 711         cyrus
 712         dbskk
 713         dovecot
 714         distcc
 715         i18n_input
 716         irqbalance
 717         lpd
 718         networkmanager
 719         pegasus
 720         postfix
 721         procmail
 722         radius
 723         rdisc
 724         rpc
 725         spamassassin
 726         timidity
 727         xdm
 728         xfs
 729
 730 * Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
 731 - Many fixes to make loadable modules build.
 732 - Add targets for sechecker.
 733 - Updated to sedoctool to read bool files and tunable
 734   files separately.
 735 - Changed the xml tag of <boolean> to <bool> to be consistent
 736   with gen_bool().
 737 - Modified the implementation of segenxml to use regular
 738   expressions.
 739 - Rename context_template() to gen_context() to clarify
 740   that its not a Reference Policy template, but a support
 741   macro.
 742 - Add disable_*_trans bool support for targeted policy.
 743 - Add MLS module to handle MLS constraint exceptions,
 744   such as reading up and writing down.
 745 - Fix errors uncovered by sediff.
 746 - Added policies:
 747         anaconda
 748         apache
 749         apm
 750         arpwatch
 751         bluetooth
 752         dmidecode
 753         finger
 754         ftp
 755         kudzu
 756         mailman
 757         ppp
 758         radvd
 759         sasl
 760         webalizer
 761
 762 * Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
 763 - Make logrotate, sendmail, sshd, and rpm policies
 764   unconfined in the targeted policy so no special
 765   modules.conf is required.
 766 - Add experimental MCS support.
 767 - Add appconfig for MLS.
 768 - Add equivalents for old can_resolve(), can_ldap(), and
 769   can_portmap() to sysnetwork.
 770 - Fix base module compile issues.
 771 - Added policies:
 772         cpucontrol
 773         cvs
 774         ktalk
 775         portmap
 776         postgresql
 777         rlogin
 778         samba
 779         snmp
 780         stunnel
 781         telnet
 782         tftp
 783         uucp
 784         vpn
 785         zebra
 786
 787 * Wed Sep 07 2005 Chris PeBenito <selinux@tresys.com> - 20050907
 788 - Fix errors uncovered by sediff.
 789 - Doc tool will explicitly say a module does not have interfaces
 790   or templates on the module page.
 791 - Added policies:
 792         comsat
 793         dbus
 794         dhcp
 795         dictd
 796         hal
 797         inn
 798         ntp
 799         squid
 800
 801 * Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
 802 - Add Makefile support for building loadable modules.
 803 - Add genclassperms.py tool to add require blocks
 804   for loadable modules.
 805 - Change sedoctool to make required modules part of base
 806   by default, otherwise make as modules, in modules.conf.
 807 - Fix segenxml to handle modules with no interfaces.
 808 - Rename ipsec connect interface for consistency.
 809 - Add missing parts of unix stream socket connect interface
 810   of ipsec.
 811 - Rename inetd connect interface for consistency.
 812 - Rename interface for purging contents of tmp, for clarity,
 813   since it allows deletion of classes other than file.
 814 - Misc. cleanups.
 815 - Added policies:
 816         acct
 817         bind
 818         firstboot
 819         gpm
 820         howl
 821         ldap
 822         loadkeys
 823         mysql
 824         privoxy
 825         quota
 826         rshd
 827         rsync
 828         su
 829         sudo
 830         tcpd
 831         tmpreaper
 832         updfstab
 833
 834 * Tue Aug 2 2005 Chris PeBenito <selinux@tresys.com> - 20050802
 835 - Fix comparison bug in fc_sort.
 836 - Fix handling of ordered and unordered HTML lists.
 837 - Corenetwork now supports multiple network interfaces having the
 838   same type.
 839 - Doc tool now creates pages for global Booleans and global tunables.
 840 - Doc tool now links directly to the interface/template in the
 841   module page when it is selected in the interface/template index.
 842 - Added support for layer summaries.
 843 - Added policies:
 844         ipsec
 845         nscd
 846         pcmcia
 847         raid
 848
 849 * Thu Jul 7 2005 Chris PeBenito <selinux@tresys.com> - 20050707
 850 - Changed xml to have modules encapsulated by layer tags, rather
 851   than putting layer="foo" in the module tags.  Also in the future
 852   we can put a summary and description for each layer.
 853 - Added tool to infer interface, module, and layer tags.  This will
 854   now list all interfaces, even if they are missing xml docs.
 855 - Shortened xml tag names.
 856 - Added macros to declare interfaces and templates.
 857 - Added interface call trace.
 858 - Updated all xml documentation for shorter and inferred tags.
 859 - Doc tool now displays templates in the web pages.
 860 - Doc tool retains the user's settings in modules.conf and
 861   tunables.conf if the files already exist.
 862 - Modules.conf behavior has been changed to be a list of all
 863   available modules, and the user can specify if the module is
 864   built as a loadable module, included in the monolithic policy,
 865   or excluded.
 866 - Added policies:
 867         fstools (fsck, mkfs, swapon, etc. tools)
 868         logrotate
 869         inetd
 870         kerberos
 871         nis (ypbind and ypserv)
 872         ssh (server, client, and agent)
 873         unconfined
 874 - Added infrastructure for targeted policy support, only missing
 875         transition boolean support.
 876
 877 * Wed Jun 15 2005 Chris PeBenito <selinux@tresys.com> - 20050615
 878         - Initial release